Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
CVE-2026-31848 Administrative Session Hijacking in Nexxt Solutions Nebula 300+ Firmware via Cookie Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31848
Post summary
CVE‑2026‑31848 discloses a session hijacking flaw in Nexxt Solutions Nebula firmware that can be exploited through cookie manipulation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | nexxtsolutions | nebula300plus | - | - | - |
| OS | nexxtsolutions | nebula300plus_firmware | - | - | - |